Tag Info

Hot answers tagged


This claim is bogus. DES itself has a 13-round differential with probability around $2^{-47}$, so TripleDES with its 48 rounds is resistant to any sort of differential attack. The paper authors are not really confident in the subject.


As with Dmitry, I assume you are applying a 4-bit s-box to a 4-by-4 array of 16 bits, first to the rows (after xoring 16 bits of key material to the plaintext), then to the columns (and lastly xoring 16 more bits of key material to produce the ciphertext). Strictly speaking, you need to specify the 4-bit s-box in order to fully evaluate it against ...


Probably the biggest vulnerability is that the message expansion is too linear. The linearity of the SHA-1 message expansion is why we are able to find such good differential paths. There can be differences at the beginning of the message and by the end of the message expansion they are mostly canceled out.


This is known as the "key complementation" property of DES; I had thought that it actually predated Biham and Shamir's work. In any case, your questions: Does this hold for only that particular combination of s box or it will be same for any S-box combination It'd remain even if you change the sbox's arbitrarily. The reason for this is that it is not ...


XORing with a key indeed does not change the difference. But usually before the XORing there is nonlinear layer (Sboxes?) which changes the difference. For example $(N rounds...)(Sbox)(AddKey)$. You can use a differential up to the beginning of this layer. Then, for different subkeys you will get same sbox output differences, but the sbox input differences ...


Your calculations are correct. The 2nd table has 2 entries of 6 in its DDT, and 18 entries of 4. The Hamsi s-box has 24 entries of 4. What can you infer from these tables? First off, CryptWizard001 is a liar. Second, the larger the max value in the DDT, the more vulnerable the s-box is to differential cryptanalysis, therefore the modified s-box does not ...

Only top voted, non community-wiki answers of a minimum length are eligible